vipkeylogger | 27619a4969bfbc3c97da5ede9c700004c9aa0435cc24df949da7e463ba34014c

General

Target

27619a4969bfbc3c97da5ede9c700004c9aa0435cc24df949da7e463ba34014c.exe
Size

692KB
MD5

5e9051eec65f58aa842721b8d40fe9fe
SHA1

04e8ce375507e09c0515094c9a4442386ddb6b4d
SHA256

27619a4969bfbc3c97da5ede9c700004c9aa0435cc24df949da7e463ba34014c
SHA512

e3b165e0c13730fe9c61aadbb17e8f8c722c4b1e9ede98c932468fef4f5fb348243f158e855e14dac72c80a8774ccd992d8c9eefffbe2c4f007cd69c95cec3b5
SSDEEP

12288:3kMEo7ji/Ov/qIwJbBcWnusvfmWzoHsDR085/RpKKnKbKBA5A2fXG/:3kDo7xSKWnueX1RN5/RDndB7gS

Score

10^/10

vipkeylogger collection discovery execution keylogger spyware stealer

Malware Config

Extracted

Family

vipkeylogger

Credentials

Protocol: smtp
Host:
mail.tonicables.top
Port:
587
Username:
[email protected]
Password:
7213575aceACE@@
Email To:
[email protected]

Signatures

VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
stealer keylogger vipkeylogger
Vipkeylogger family
vipkeylogger

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exe

pid	Process
2748	powershell.exe
2848	powershell.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

27619a4969bfbc3c97da5ede9c700004c9aa0435cc24df949da7e463ba34014c.exe

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	27619a4969bfbc3c97da5ede9c700004c9aa0435cc24df949da7e463ba34014c.exe
Key opened	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	27619a4969bfbc3c97da5ede9c700004c9aa0435cc24df949da7e463ba34014c.exe
Key opened	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	27619a4969bfbc3c97da5ede9c700004c9aa0435cc24df949da7e463ba34014c.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
4	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

Processes:

27619a4969bfbc3c97da5ede9c700004c9aa0435cc24df949da7e463ba34014c.exe

description	pid	Process	procid_target
PID 1508 set thread context of 1784	1508	27619a4969bfbc3c97da5ede9c700004c9aa0435cc24df949da7e463ba34014c.exe	37

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

schtasks.exe27619a4969bfbc3c97da5ede9c700004c9aa0435cc24df949da7e463ba34014c.exe27619a4969bfbc3c97da5ede9c700004c9aa0435cc24df949da7e463ba34014c.exepowershell.exepowershell.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	27619a4969bfbc3c97da5ede9c700004c9aa0435cc24df949da7e463ba34014c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	27619a4969bfbc3c97da5ede9c700004c9aa0435cc24df949da7e463ba34014c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

schtasks.exe

pid	Process
2880	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

27619a4969bfbc3c97da5ede9c700004c9aa0435cc24df949da7e463ba34014c.exe27619a4969bfbc3c97da5ede9c700004c9aa0435cc24df949da7e463ba34014c.exepowershell.exepowershell.exe

pid	Process
1508	27619a4969bfbc3c97da5ede9c700004c9aa0435cc24df949da7e463ba34014c.exe
1508	27619a4969bfbc3c97da5ede9c700004c9aa0435cc24df949da7e463ba34014c.exe
1784	27619a4969bfbc3c97da5ede9c700004c9aa0435cc24df949da7e463ba34014c.exe
2848	powershell.exe
2748	powershell.exe
1784	27619a4969bfbc3c97da5ede9c700004c9aa0435cc24df949da7e463ba34014c.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

27619a4969bfbc3c97da5ede9c700004c9aa0435cc24df949da7e463ba34014c.exe27619a4969bfbc3c97da5ede9c700004c9aa0435cc24df949da7e463ba34014c.exepowershell.exepowershell.exe

description	pid	Process
Token: SeDebugPrivilege	1508	27619a4969bfbc3c97da5ede9c700004c9aa0435cc24df949da7e463ba34014c.exe
Token: SeDebugPrivilege	1784	27619a4969bfbc3c97da5ede9c700004c9aa0435cc24df949da7e463ba34014c.exe
Token: SeDebugPrivilege	2848	powershell.exe
Token: SeDebugPrivilege	2748	powershell.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

27619a4969bfbc3c97da5ede9c700004c9aa0435cc24df949da7e463ba34014c.exe

description	pid	Process	procid_target
PID 1508 wrote to memory of 2748	1508	27619a4969bfbc3c97da5ede9c700004c9aa0435cc24df949da7e463ba34014c.exe	31
PID 1508 wrote to memory of 2748	1508	27619a4969bfbc3c97da5ede9c700004c9aa0435cc24df949da7e463ba34014c.exe	31
PID 1508 wrote to memory of 2748	1508	27619a4969bfbc3c97da5ede9c700004c9aa0435cc24df949da7e463ba34014c.exe	31
PID 1508 wrote to memory of 2748	1508	27619a4969bfbc3c97da5ede9c700004c9aa0435cc24df949da7e463ba34014c.exe	31
PID 1508 wrote to memory of 2848	1508	27619a4969bfbc3c97da5ede9c700004c9aa0435cc24df949da7e463ba34014c.exe	33
PID 1508 wrote to memory of 2848	1508	27619a4969bfbc3c97da5ede9c700004c9aa0435cc24df949da7e463ba34014c.exe	33
PID 1508 wrote to memory of 2848	1508	27619a4969bfbc3c97da5ede9c700004c9aa0435cc24df949da7e463ba34014c.exe	33
PID 1508 wrote to memory of 2848	1508	27619a4969bfbc3c97da5ede9c700004c9aa0435cc24df949da7e463ba34014c.exe	33
PID 1508 wrote to memory of 2880	1508	27619a4969bfbc3c97da5ede9c700004c9aa0435cc24df949da7e463ba34014c.exe	35
PID 1508 wrote to memory of 2880	1508	27619a4969bfbc3c97da5ede9c700004c9aa0435cc24df949da7e463ba34014c.exe	35
PID 1508 wrote to memory of 2880	1508	27619a4969bfbc3c97da5ede9c700004c9aa0435cc24df949da7e463ba34014c.exe	35
PID 1508 wrote to memory of 2880	1508	27619a4969bfbc3c97da5ede9c700004c9aa0435cc24df949da7e463ba34014c.exe	35
PID 1508 wrote to memory of 1784	1508	27619a4969bfbc3c97da5ede9c700004c9aa0435cc24df949da7e463ba34014c.exe	37
PID 1508 wrote to memory of 1784	1508	27619a4969bfbc3c97da5ede9c700004c9aa0435cc24df949da7e463ba34014c.exe	37
PID 1508 wrote to memory of 1784	1508	27619a4969bfbc3c97da5ede9c700004c9aa0435cc24df949da7e463ba34014c.exe	37
PID 1508 wrote to memory of 1784	1508	27619a4969bfbc3c97da5ede9c700004c9aa0435cc24df949da7e463ba34014c.exe	37
PID 1508 wrote to memory of 1784	1508	27619a4969bfbc3c97da5ede9c700004c9aa0435cc24df949da7e463ba34014c.exe	37
PID 1508 wrote to memory of 1784	1508	27619a4969bfbc3c97da5ede9c700004c9aa0435cc24df949da7e463ba34014c.exe	37
PID 1508 wrote to memory of 1784	1508	27619a4969bfbc3c97da5ede9c700004c9aa0435cc24df949da7e463ba34014c.exe	37
PID 1508 wrote to memory of 1784	1508	27619a4969bfbc3c97da5ede9c700004c9aa0435cc24df949da7e463ba34014c.exe	37
PID 1508 wrote to memory of 1784	1508	27619a4969bfbc3c97da5ede9c700004c9aa0435cc24df949da7e463ba34014c.exe	37

outlook_office_path 1 IoCs

Processes:

27619a4969bfbc3c97da5ede9c700004c9aa0435cc24df949da7e463ba34014c.exe

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	27619a4969bfbc3c97da5ede9c700004c9aa0435cc24df949da7e463ba34014c.exe

outlook_win_path 1 IoCs

Processes:

27619a4969bfbc3c97da5ede9c700004c9aa0435cc24df949da7e463ba34014c.exe

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	27619a4969bfbc3c97da5ede9c700004c9aa0435cc24df949da7e463ba34014c.exe

C:\Users\Admin\AppData\Local\Temp\27619a4969bfbc3c97da5ede9c700004c9aa0435cc24df949da7e463ba34014c.exe
"C:\Users\Admin\AppData\Local\Temp\27619a4969bfbc3c97da5ede9c700004c9aa0435cc24df949da7e463ba34014c.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1508
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\27619a4969bfbc3c97da5ede9c700004c9aa0435cc24df949da7e463ba34014c.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2748
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\fahKSvwo.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2848
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\fahKSvwo" /XML "C:\Users\Admin\AppData\Local\Temp\tmp48D3.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2880
- C:\Users\Admin\AppData\Local\Temp\27619a4969bfbc3c97da5ede9c700004c9aa0435cc24df949da7e463ba34014c.exe
  "C:\Users\Admin\AppData\Local\Temp\27619a4969bfbc3c97da5ede9c700004c9aa0435cc24df949da7e463ba34014c.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:1784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

Browser Information Discovery

1

T1217

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp48D3.tmp

Filesize
1KB

MD5
bb7a1f757aebc320bada20e6a220ebb9

SHA1
dd00ff7dcb11302dae323102fd6425d18264d451

SHA256
aa7b1496ce298af36d596b4181153596702b3d9c71c8108c5782c58572b9bb07

SHA512
f8290074fac490d9c4278d8f2ed7667bcedc6f0192784c420eb92572e77b47b92c2dd407cd472f5092bc722df2ae7803b3d7f1d5a4191c3d74ec02a296211a94

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\C3OM0TG52K2H22MCEHWZ.temp

Filesize
7KB

MD5
98a8fbec16fdb4b056d05ab876402dd2

SHA1
966aba864a94664d59531e18260361d93472b4d4

SHA256
ee7e493f986094add796026fc30e1363a0f146dc9fabb8cb8a130b7a5c693230

SHA512
51144050032a78a6e041a46319b2d541573c24c30d8f5449cd2ad6bd688195de5be89aab88f60f50db91eda9c56407d3b68220b36b88b48f433537295376693b

Download Submit
memory/1508-30-0x0000000073EA0000-0x000000007458E000-memory.dmp

Filesize
6.9MB

Download
memory/1508-1-0x0000000001060000-0x0000000001112000-memory.dmp

Filesize
712KB

Download
memory/1508-2-0x0000000073EA0000-0x000000007458E000-memory.dmp

Filesize
6.9MB

Download
memory/1508-3-0x0000000000390000-0x00000000003A2000-memory.dmp

Filesize
72KB

Download
memory/1508-4-0x0000000073EA0000-0x000000007458E000-memory.dmp

Filesize
6.9MB

Download
memory/1508-5-0x0000000005C40000-0x0000000005CCE000-memory.dmp

Filesize
568KB

Download
memory/1508-0-0x0000000073EAE000-0x0000000073EAF000-memory.dmp

Filesize
4KB

Download
memory/1784-22-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/1784-28-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/1784-27-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/1784-26-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1784-24-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/1784-20-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/1784-18-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/1784-29-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads